# rm-rf-prod/GroundTruth-MCP [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/rm-rf-prod/GroundTruth-MCP  
**GitHub Stars:** 6  
**Views:** 3  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/rm-rf-prod-groundtruth-mcp

## Description
Self-hosted MCP for live docs, code audits, snippets, and best practices across 445+ libraries. 14 tools, 107 audit patterns with file:line precision, BM25-ranked snippets, lockfile-aware version pinning, npm/PyPI/crates.io/Go fallback. No API keys, no rate limits, Context7 alternative. npx -y @groundtruth-mcp/gt-mcp

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "groundtruth-mcp": {
    "command": "npx",
    "args": ["-y","@groundtruth-mcp/gt-mcp@latest"],
    "env": {
      "GT_GITHUB_TOKEN": ""
    }
  }
}
```

**Requires environment variables:** `GT_GITHUB_TOKEN` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What rm-rf-prod/GroundTruth-MCP MCP server does

rm-rf-prod/GroundTruth-MCP MCP server gives an AI assistant a local set of tools for researching libraries, reviewing source code, and checking implementation choices against current references. Its library workflow can resolve packages, retrieve documentation for a topic, find recommended and discouraged patterns, compare two or three libraries, retrieve release notes, and find migration material. The supported package fallbacks include npm, PyPI, crates.io, and pkg.go.dev.

The server also covers broader technical subjects through search. The documented search areas include OWASP security guidance, WCAG and WAI-ARIA, browser and web APIs, CSS, performance, AI provider documentation, Google APIs, infrastructure, and databases. Code examples can be retrieved from GitHub, while snippets are pre-indexed and ranked by library and version.

## How it works

rm-rf-prod/GroundTruth-MCP MCP server runs on the developer’s machine and retrieves documentation when requested. Its source options include `llms.txt`, Jina Reader, GitHub, and package registries used as fallbacks. The README describes an on-disk cache for snippets and atomic cache handling. GitHub requests work without credentials, although unauthenticated requests are limited to 60 per hour; an optional GitHub token raises that limit to 5,000 requests per hour.

For project-wide guidance, `gt_auto_scan` reads a supported manifest and identifies dependencies before fetching best-practice information. Supported manifest files include `package.json`, `requirements.txt`, `pyproject.toml`, `Cargo.toml`, `go.mod`, `pom.xml`, `build.gradle`, and `composer.json`.

The `gt_audit` tool walks project files and applies more than 107 checks across 18 categories. Documented checks include security issues such as SQL injection, XSS, SSRF, path traversal, and hardcoded credentials; accessibility problems; React and Next.js patterns; TypeScript issues; performance concerns; Node.js issues; and Python risks. Results include severity, category, counts, exact `file:line` locations, and fix guidance from an authoritative source.

## Setup and configuration

Install the server with Node.js 24 or newer. For MCP clients that use a JSON configuration, run `npx` with the package `@groundtruth-mcp/gt-mcp@latest` and the `-y` flag. The README specifically shows configuration for Cursor, Claude Desktop, and VS Code, and also provides a Claude Code command.

No build step or configuration file is required. Using the `@latest` tag causes npx to retrieve the newest package when a session starts. Set `GT_GITHUB_TOKEN` only if higher GitHub request limits are needed; the README says the token does not need additional scopes.

The dispatch tool can route plain-language requests to the appropriate operation, while individual tools remain available for callers that need explicit arguments. Examples include resolving a library, auditing a project path, checking browser compatibility, comparing libraries, or retrieving a changelog for a version.

## Limitations and notes

The server is self-hosted and depends on external documentation sources for live results. GitHub access is rate-limited without the optional token. Its package metadata and README identify the project as licensed under Elastic License 2.0. The provided material does not describe support for clients beyond the listed configurations or guarantee that every library has a curated entry; registry fallbacks are used when a library cannot be found in the primary catalog.

_Full upstream README: https://allmcps.com/mcp/rm-rf-prod-groundtruth-mcp/readme_